The Agent Skills Directory

[SAFE]: The skill follows secure development practices by enforcing restrictive file permissions (0700 for the .session directory and 0600 for its internal state files) and by including defensive checks that prevent modification of orchestration state when executed within the global skills repository root.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to call the Git CLI and local Python scripts (such as chain_state.py and entry.py). These operations are used for repository metadata analysis and state synchronization. The command inputs are confined to project-local paths and internal configuration, representing standard functional requirements for a development-focused orchestration skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository-local product plans and Codex session logs. It mitigates injection risks through structural validation (via validate_goal.py) and strict filtering in project_inventory.py, which excludes message content and potential secrets from its inventory output.
Ingestion points: Reads project files, Git history, and Codex session logs in scripts/project_inventory.py and scripts/session_workspace.py.
Boundary markers: The skill defines a Source Precedence hierarchy and Hard Rules in SKILL.md, and uses validate_goal.py to enforce a Markdown schema for objectives.
Capability inventory: Uses subprocess.run, create_goal, update_plan, and codex_app__create_thread across its scripts.
Sanitization: Employs filtering logic in project_inventory.py to avoid processing message bodies or secrets, and validates the schema of program plans in session_workspace.py.

session-orchestrate